CVE-2025-13275

MediumCVSS 4.7

Published: 17/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

A security vulnerability has been detected in Iqbolshoh php-business-website up to version 10677743a8dfc281f85291a27cf63a0bce043c24. It affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available.

Risk Assessment

Risk of remote uploading of malicious files to the server, potentially leading to full application compromise, code execution, or data theft.

Recommendation

Immediately restrict access to the /admin/about.php file and check for unauthorized file uploads. Contact the vendor for updates or temporary mitigations.

Other vulnerabilities in php-business-website

CVE-2025-12224Low
A flaw has been found in Iqbolshoh php-business-website up to commit 10677743a8dfc281f85291a27cf63a0bce043c24. The vulnerability affects unknown code in admin/contact.php. Manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The product uses a rolling release model, so specific version information is not available. The vendor was contacted but did not respond.

Original NVD description (English source)

A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS